1

How do you setup blacklists for Microsoft Exchange 2003? For example, RBL or CBL lists mitigating known spam. Is it recommended to maintain several blacklists together? If so, is there a set that should usually be included for any serious production server?

3 Answers 3

2

Regarding blacklists, I recommend that you try to pull the data from the RBL (often via rsync) and do your own sanitizing(1) on the downloaded list and run something like RBLDNSD or Wrbldnsd to serve the blacklist to your mailserver(s). Otherwise you will give away total-control to a third party to choose if you should receive or block a certain mail (depending on configuration). A better idea is to use several RBL's and increase "spaminess" score on each hit.

(1)Things we check for in the downloaded feed and removes if found:

  • Own ip addresses
  • Important customers network
  • Other well known mail-servers
  • Errors, and Internet-wide blocks (has happened)
2

When we did our own spam and virus filtering, we used spamhaus as our only blacklist.

Since we switched to "Microsoft Forefront Online Security for Exchange" (the name seems to keep getting longer!) a couple of years ago, we don't pay any attention to blacklists any more, they take care of it.

If we had to do spam/virus filtering in-house again, I'd be following most of rkthkr's advice.

("Microsoft Forefront Online Security for Exchange" is the name for the spam/virus filtering component of "Microsoft Exchange Hosted Services" which is what MS originally called "Frontbridge" when they bought them and then Frontbridge was originally called "Bigfish" when it started.)

1

We are using the following RBL Service Providers with good results in an exchange scenario but throught ASSP anti-Spam Proxy along with bayesian filtering and withelisting for our important partners:

  • zen.spamhaus.org
  • list.dsbl.org
  • dul.dnsbl.sorbs.net

  • 1
    • A heads up on SORBS, SORBS are having problems getting a new hosting provider and risks of being shut down 20th July 2009 at 12 noon. us.sorbs.net
      – rkthkr
      Jun 26, 2009 at 6:39

    You must log in to answer this question.

    Not the answer you're looking for? Browse other questions tagged .